@gajae-code/coding-agent 0.18.6 → 0.18.8

package/src/config/model-registry.ts

@@ -13,6 +13,7 @@ import {
 	type Context,
 	codexContextOverrideKey,
 	createModelManager,
+	createTrustedStrippedModelClone,
 	Effort,
 	enrichModelThinking,
 	getBundledModels,
@@ -49,6 +50,8 @@ import {
 	readBoundedModelsJson,
 	resolveLoopbackOpenAIBaseUrl,
 } from "@gajae-code/ai/utils/discovery/openai-compatible";
+// Internal-only: registerFinalizedModelClone is not part of the public @gajae-code/ai surface
+import { registerFinalizedModelClone } from "@gajae-code/ai/utils/trusted-model-clone";
 
 // Sentinels for local-only OAuth tokens — declared inline to avoid loading provider
 // modules at startup. Must match the provider OAuth modules.
@@ -1771,9 +1774,6 @@ export class ModelRegistry {
 		{
 			fresh: boolean;
 			modelIds: ReadonlySet<string>;
-			profileModelIds?: ReadonlySet<string>;
-			profileFresh?: boolean;
-			profileEndpoint?: string;
 			authGeneration: string;
 			endpoint: string;
 		}
@@ -2746,20 +2746,7 @@ export class ModelRegistry {
 		}));
 	}
 	#stripModelBaseUrlQueries(models: readonly Model<Api>[]): Model<Api>[] {
-		return models.map(model => {
-			if (!model.baseUrl) return model;
-			try {
-				const parsed = new URL(model.baseUrl);
-				parsed.username = "";
-				parsed.password = "";
-				parsed.search = "";
-				parsed.hash = "";
-				return { ...model, baseUrl: parsed.toString().replace(/\/$/, "") };
-			} catch {
-				const { baseUrl: _baseUrl, ...withoutBaseUrl } = model;
-				return withoutBaseUrl as Model<Api>;
-			}
-		});
+		return models.map(model => createTrustedStrippedModelClone(model));
 	}
 	#stripUrlUserinfo(url: string | undefined): string | undefined {
 		if (!url) return url;
@@ -3288,6 +3275,11 @@ export class ModelRegistry {
 									result.provider,
 									this.#providerEvidenceApiKeys.get(result.provider),
 								) &&
+							result.configurationGeneration ===
+								this.authStorage.getProviderConfigurationGeneration(
+									result.provider,
+									this.#authStorageConfigOwner,
+								) &&
 							result.endpoint ===
 								this.#normalizeDiscoveryEvidenceEndpoint(
 									this.#effectiveDiscoveryProviderConfig(providerConfig).baseUrl ?? "",
@@ -3309,7 +3301,10 @@ export class ModelRegistry {
 									this.#providerEvidenceApiKeys.get(result.provider),
 								) ||
 							result.configurationGeneration !==
-								this.authStorage.getProviderConfigurationGeneration(result.provider) ||
+								this.authStorage.getProviderConfigurationGeneration(
+									result.provider,
+									this.#authStorageConfigOwner,
+								) ||
 							result.endpoint !==
 								this.#normalizeDiscoveryEvidenceEndpoint(
 									this.#effectiveDiscoveryProviderConfig(providerConfig).baseUrl ?? "",
@@ -3334,9 +3329,6 @@ export class ModelRegistry {
 				| {
 						fresh: boolean;
 						modelIds: ReadonlySet<string>;
-						profileModelIds?: ReadonlySet<string>;
-						profileFresh?: boolean;
-						profileEndpoint?: string;
 						authGeneration: string;
 						endpoint: string;
 				  }
@@ -3481,12 +3473,9 @@ export class ModelRegistry {
 				.map(([provider, evidence]) => [
 					provider,
 					evidence.fresh,
-					evidence.profileFresh,
 					evidence.authGeneration,
 					evidence.endpoint,
-					evidence.profileEndpoint,
 					[...evidence.modelIds].sort(),
-					evidence.profileModelIds === undefined ? undefined : [...evidence.profileModelIds].sort(),
 				]),
 			configured: [...this.#configuredDiscoveryEvidence.entries()]
 				.sort(([left], [right]) => left.localeCompare(right))
@@ -3540,7 +3529,10 @@ export class ModelRegistry {
 			? this.authStorage.has(provider) ||
 				this.authStorage.hasAuth(provider, undefined, { owner: this.#authStorageConfigOwner })
 			: !this.#isCredentiallessProvider(provider);
-		let preflightAuthConfigurationGeneration = this.authStorage.getProviderConfigurationGeneration(provider);
+		let preflightAuthConfigurationGeneration = this.authStorage.getProviderConfigurationGeneration(
+			provider,
+			this.#authStorageConfigOwner,
+		);
 		let preflightOAuthRefreshGeneration = this.authStorage.getProviderOAuthRefreshGeneration(provider);
 		if (shouldPreflightAuth) {
 			if (optionalAuth && isCurrentPreflight()) this.#credentiallessAuthFallbackProviders.delete(provider);
@@ -3555,7 +3547,10 @@ export class ModelRegistry {
 						credentialSessionId,
 					}),
 				);
-				const currentAuthConfigurationGeneration = this.authStorage.getProviderConfigurationGeneration(provider);
+				const currentAuthConfigurationGeneration = this.authStorage.getProviderConfigurationGeneration(
+					provider,
+					this.#authStorageConfigOwner,
+				);
 				if (preflightAuthConfigurationGeneration !== currentAuthConfigurationGeneration) {
 					const currentOAuthRefreshGeneration = this.authStorage.getProviderOAuthRefreshGeneration(provider);
 					if (
@@ -3633,6 +3628,9 @@ export class ModelRegistry {
 		const isCurrentEndpoint = () =>
 			endpoint ===
 			this.#normalizeDiscoveryEvidenceEndpoint(this.#effectiveDiscoveryProviderConfig(providerConfig).baseUrl ?? "");
+		const isCurrentAuthConfiguration = () =>
+			preflightAuthConfigurationGeneration ===
+			this.authStorage.getProviderConfigurationGeneration(provider, this.#authStorageConfigOwner);
 		const isCurrentProviderRefresh = () =>
 			providerRefresh === undefined ||
 			("providerId" in providerRefresh
@@ -3704,7 +3702,7 @@ export class ModelRegistry {
 			},
 			getEvidenceGeneration: provider => this.#getProviderEvidenceGeneration(provider.provider, preflightApiKey),
 			cacheDynamicModelProvenance: cacheLookupProvenance,
-			canPublishCache: () => isCurrentEndpoint() && isCurrentProviderRefresh(),
+			canPublishCache: () => isCurrentAuthConfiguration() && isCurrentEndpoint() && isCurrentProviderRefresh(),
 		});
 		const authGeneration =
 			mergeInput.authGeneration ??
@@ -3712,6 +3710,7 @@ export class ModelRegistry {
 		const current =
 			mergeInput.current &&
 			authGeneration === this.#getProviderEvidenceGeneration(effectiveProviderConfig.provider, preflightApiKey) &&
+			isCurrentAuthConfiguration() &&
 			isCurrentEndpoint();
 		if (!current) {
 			return {
@@ -3899,9 +3898,15 @@ export class ModelRegistry {
 		// The token is only needed if the dynamic fetch fires (cache miss),
 		// and failures there are handled gracefully.
 		const peekKey = async (descriptor: { providerId: string }) => {
-			const configurationGeneration = this.authStorage.getProviderConfigurationGeneration(descriptor.providerId);
+			const configurationGeneration = this.authStorage.getProviderConfigurationGeneration(
+				descriptor.providerId,
+				this.#authStorageConfigOwner,
+			);
 			const apiKey = await this.#peekApiKeyForProvider(descriptor.providerId, { credentialSessionId });
-			if (configurationGeneration !== this.authStorage.getProviderConfigurationGeneration(descriptor.providerId)) {
+			if (
+				configurationGeneration !==
+				this.authStorage.getProviderConfigurationGeneration(descriptor.providerId, this.#authStorageConfigOwner)
+			) {
 				return { apiKey: undefined, authGeneration: undefined };
 			}
 			return {
@@ -4071,13 +4076,6 @@ export class ModelRegistry {
 				this.#descriptorDiscoveryEvidence.set(options.providerId, {
 					fresh: result.fetched,
 					modelIds: new Set(models.map(model => model.id)),
-					...(result.dynamicModelIds === undefined
-						? {}
-						: {
-								profileModelIds: new Set(result.dynamicModelIds),
-								profileFresh: !result.stale,
-								profileEndpoint: endpoint,
-							}),
 					authGeneration,
 					endpoint: this.#normalizeDiscoveryEvidenceEndpoint(models[0]?.baseUrl ?? endpoint),
 				});
@@ -5005,6 +5003,14 @@ export class ModelRegistry {
 			}
 			const generated = this.#generatedAuthHeaders.get(models[index]!);
 			if (generated) this.#generatedAuthHeaders.set(result[index]!, generated);
+			// Register finalized clone as trusted if the original is trusted
+			// registerFinalizedModelClone builds a fresh trusted object from the original's snapshot
+			if (result[index]) {
+				const registeredClone = registerFinalizedModelClone(models[index]!, result[index]);
+				if (registeredClone) {
+					result[index] = registeredClone;
+				}
+			}
 		}
 		return result;
 	}
@@ -5648,9 +5654,10 @@ export class ModelRegistry {
 
 	/**
 	 * Get selectable models with auth configured.
-	 * This is a fast check that doesn't refresh OAuth tokens. A current,
-	 * authoritative live catalog also limits each provider to its enrolled ids;
-	 * bundled entries remain the fallback until that evidence exists.
+	 * This is a fast check that doesn't refresh OAuth tokens. The bundled catalog
+	 * is authoritative for visibility: live discovery only enriches entries and
+	 * adds unknown ids, and never removes a bundled model. A provider that cannot
+	 * serve a model reports its own error when the model is used.
 	 */
 	getAvailable(): Model<Api>[] {
 		this.#synchronizeEnvironmentCredentials();
@@ -5664,82 +5671,12 @@ export class ModelRegistry {
 		) {
 			return this.#availableModelsCache;
 		}
-		const authoritativeDiscoveryIds = new Map<string, ReadonlySet<string> | undefined>();
-		const bundledIdsByProvider = new Map<string, Set<string>>();
-		this.#availableModelsCache = this.#models.filter(model => {
-			if (!this.#isModelAvailable(model, disabledProviders)) return false;
-
-			let liveIds = authoritativeDiscoveryIds.get(model.provider);
-			if (!authoritativeDiscoveryIds.has(model.provider)) {
-				liveIds = this.#getAuthoritativeDiscoveredModelIds(model.provider);
-				authoritativeDiscoveryIds.set(model.provider, liveIds);
-			}
-			// Undefined means discovery has not run successfully for the current
-			// provider context. Keep the bundled catalog as the explicit fallback.
-			if (liveIds === undefined) return true;
-			if (this.#hasCustomModelOverlay(model.provider, model.id)) return true;
-
-			const activity = this.#providerActivity.get(model.provider);
-			if (!activity?.staticModelIds.has(model.id)) return liveIds.has(model.id);
-
-			let bundledIds = bundledIdsByProvider.get(model.provider);
-			if (!bundledIds) {
-				bundledIds = new Set(
-					(getBundledModels(model.provider as Parameters<typeof getBundledModels>[0]) as Model<Api>[]).map(
-						candidate => candidate.id,
-					),
-				);
-				bundledIdsByProvider.set(model.provider, bundledIds);
-			}
-			return !bundledIds.has(model.id) || liveIds.has(model.id);
-		});
+		this.#availableModelsCache = this.#models.filter(model => this.#isModelAvailable(model, disabledProviders));
 		this.#availableModelsDisabledProviders = disabledProviderKey;
 		this.#availableModelsEnvFingerprint = envFingerprint;
 		return this.#availableModelsCache;
 	}
 
-	/**
-	 * Return the current live model ids only when discovery produced an
-	 * authoritative catalog for the provider and endpoint. An unavailable or
-	 * failed discovery returns undefined so callers retain the bundled fallback.
-	 */
-	#getAuthoritativeDiscoveredModelIds(provider: string): ReadonlySet<string> | undefined {
-		const descriptorEvidence = this.#descriptorDiscoveryEvidence.get(provider);
-		if (descriptorEvidence?.profileFresh && descriptorEvidence.profileModelIds !== undefined) {
-			try {
-				if (
-					descriptorEvidence.authGeneration === this.#getProviderEvidenceGeneration(provider) &&
-					descriptorEvidence.profileEndpoint ===
-						this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(provider) ?? "")
-				) {
-					return descriptorEvidence.profileModelIds;
-				}
-			} catch {
-				// A provider context that can no longer be verified must use its fallback.
-			}
-		}
-
-		const configuredEvidence = this.#configuredDiscoveryEvidence.get(provider);
-		if (!configuredEvidence) return undefined;
-		const discoveryState = this.#discoveryManager.getState(provider);
-		if (
-			discoveryState?.status !== "ok" &&
-			discoveryState?.status !== "cached" &&
-			discoveryState?.status !== "empty"
-		) {
-			return undefined;
-		}
-		try {
-			return configuredEvidence.authGeneration === this.#getProviderEvidenceGeneration(provider) &&
-				configuredEvidence.endpoint ===
-					this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(provider) ?? "")
-				? configuredEvidence.modelIds
-				: undefined;
-		} catch {
-			return undefined;
-		}
-	}
-
 	#synchronizeEnvironmentCredentials(): void {
 		// Runtime registrations own a provider while their credential is present.
 		// Refresh them first so a missing runtime env key can hand ownership back to
@@ -5753,49 +5690,6 @@ export class ModelRegistry {
 		}
 	}
 
-	/**
-	 * Get authenticated models, excluding bundled entries that a fresh provider
-	 * catalog has positively shown to be unavailable. Bundled entries remain
-	 * usable until live catalog evidence exists so offline startup is unchanged.
-	 */
-	getAvailableForProfileActivation(): Model<Api>[] {
-		const bundledIdsByProvider = new Map<string, Set<string>>();
-		// Evidence staleness depends only on the provider, and resolving it scans the
-		// catalog for the provider base URL. Decide it once per provider per call so a
-		// multi-thousand-model catalog is not rescanned for every model.
-		const staleEvidenceByProvider = new Map<string, boolean>();
-		return this.getAvailable().filter(model => {
-			const evidence = this.#descriptorDiscoveryEvidence.get(model.provider);
-			if (!evidence?.profileFresh || evidence.profileModelIds === undefined) return true;
-			if (this.#hasCustomModelOverlay(model.provider, model.id)) return true;
-			let bundledModelIds = bundledIdsByProvider.get(model.provider);
-			if (!bundledModelIds) {
-				bundledModelIds = new Set(
-					(getBundledModels(model.provider as Parameters<typeof getBundledModels>[0]) as Model<Api>[]).map(
-						candidate => candidate.id,
-					),
-				);
-				bundledIdsByProvider.set(model.provider, bundledModelIds);
-			}
-			if (!bundledModelIds.has(model.id)) return true;
-			let staleEvidence = staleEvidenceByProvider.get(model.provider);
-			if (staleEvidence === undefined) {
-				staleEvidence =
-					evidence.authGeneration !== this.#getProviderEvidenceGeneration(model.provider) ||
-					evidence.profileEndpoint !==
-						this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(model.provider) ?? "");
-				staleEvidenceByProvider.set(model.provider, staleEvidence);
-			}
-			if (staleEvidence) return true;
-			return evidence.profileModelIds.has(model.id);
-		});
-	}
-
-	#hasCustomModelOverlay(provider: string, id: string): boolean {
-		const matches = (overlay: CustomModelOverlay) => overlay.provider === provider && overlay.id === id;
-		return this.#customModelOverlays.some(matches) || this.#runtimeModelOverlays.some(matches);
-	}
-
 	#hasFreshOrStaticModelEvidence(model: Model<Api>): boolean {
 		const evidence = this.#providerActivity.get(model.provider);
 		if (

package/src/config/settings.ts

@@ -1104,6 +1104,41 @@ export class Settings implements NotificationSettingsReader {
 		if (saveError !== undefined) throw saveError;
 	}
 
+	/** Copy execution settings without reloading, persisting, or sharing mutable layers. */
+	snapshot(): Settings {
+		const cloned = new Settings({ cwd: this.#cwd, agentDir: this.#agentDir, inMemory: true });
+		cloned.#global = structuredClone(this.#global);
+		cloned.#project = structuredClone(this.#project);
+		cloned.#overrides = structuredClone(this.#overrides);
+		cloned.#merged = structuredClone(this.#merged);
+		cloned.#schemaReport = structuredClone(this.#schemaReport);
+		cloned.#autoroutingEffective = structuredClone(this.#autoroutingEffective);
+		cloned.#autoroutingLocalIssues = structuredClone(this.#autoroutingLocalIssues);
+		cloned.#schemaMigrationPending = this.#schemaMigrationPending;
+		cloned.#futureSchemaVersion = this.#futureSchemaVersion;
+		cloned.#hasMalformedConfigRoot = this.#hasMalformedConfigRoot;
+		cloned.#hasRecoveredConfigSyntax = this.#hasRecoveredConfigSyntax;
+		cloned.#hasInvalidNotificationGlobal = this.#hasInvalidNotificationGlobal;
+		cloned.#notificationValidationGeneration = this.#notificationValidationGeneration;
+		cloned.#rawNotificationConfig = structuredClone(this.#rawNotificationConfig);
+		cloned.#durableRawNotificationConfig = structuredClone(this.#durableRawNotificationConfig);
+		cloned.#durableNotificationFingerprint = this.#durableNotificationFingerprint;
+		return cloned;
+	}
+
+	/** Resolve a retained execution's project layer without persistence or global hooks. */
+	async snapshotForCwd(cwd: string): Promise<Settings> {
+		const cloned = this.snapshot();
+		if (path.resolve(cwd) === path.resolve(this.#cwd)) return cloned;
+		cloned.#cwd = path.resolve(cwd);
+		cloned.#readonly = true;
+		cloned.#project = {};
+		cloned.#rebuildMerged();
+		cloned.#project = await cloned.#loadProjectSettings(true);
+		await cloned.#normalizeAfterLoad(false);
+		return cloned;
+	}
+
 	async cloneForCwd(cwd: string): Promise<Settings> {
 		// A clone shares the same config queue. Settle an already-reserved local
 		// debounce before the clone can enqueue a durable selector, preventing it
@@ -1572,9 +1607,14 @@ export class Settings implements NotificationSettingsReader {
 		return reconciled.settings;
 	}
 
-	async #loadProjectSettings(): Promise<RawSettings> {
+	async #loadProjectSettings(bypassCache = false): Promise<RawSettings> {
 		try {
-			const result = await loadCapability(settingsCapability.id, { cwd: this.#cwd, settings: this });
+			const result = await loadCapability(settingsCapability.id, {
+				cwd: this.#cwd,
+				agentDir: this.#agentDir,
+				settings: this,
+				bypassCache,
+			});
 			let merged: RawSettings = {};
 			for (const item of result.items as SettingsCapabilityItem[]) {
 				if (item.level !== "project") continue;
@@ -1637,7 +1677,7 @@ export class Settings implements NotificationSettingsReader {
 		return settings;
 	}
 
-	async #normalizeAfterLoad(): Promise<void> {
+	async #normalizeAfterLoad(publishHooks = true): Promise<void> {
 		this.#sanitizeModelSelectorRecords();
 		this.#rebuildMerged();
 		if (!this.#futureSchemaVersion) {
@@ -1653,7 +1693,7 @@ export class Settings implements NotificationSettingsReader {
 		await this.flush();
 		this.#sanitizeModelSelectorRecords();
 		this.#rebuildMerged();
-		this.#fireAllHooks();
+		if (publishHooks) this.#fireAllHooks();
 	}
 
 	#sanitizeModelSelectorRecords(): void {

package/src/config/skill-settings-defaults.ts

@@ -51,6 +51,13 @@ export function resolveSkillScopeTrust(
 	return DEFAULT_SKILL_SCOPE_TRUST;
 }
 
+/** Resolve permission to read a user's external skill symlinks from user-owned config only. */
+export function resolveGlobalUserSkillLinkTrust(
+	settings: Pick<SkillDiscoverySettings, "trustUserSkills" | "enablePiUser">,
+): boolean {
+	return resolveSkillScopeTrust(settings, "user");
+}
+
 export const DEFAULT_SKILL_DISCOVERY_SETTINGS: SkillDiscoverySettings = {
 	enabled: true,
 	enableSkillCommands: true,

package/src/coordinator-mcp/policy.ts

@@ -122,8 +122,9 @@ function parseRootList(value: string | undefined): string[] {
 }
 
 function resolveManagedWorktreeRoot(root: string, configured: string | undefined): string {
-	const template = (configured?.trim() || "{repo}/.worktrees").replace(/^~(?=\/|$)/, os.homedir());
-	const resolved = template.replaceAll("{repo}", path.basename(root));
+	// Function replacers so a `$` in the home or repository path is kept verbatim.
+	const template = (configured?.trim() || "{repo}/.worktrees").replace(/^~(?=\/|$)/, () => os.homedir());
+	const resolved = template.replaceAll("{repo}", () => path.basename(root));
 	return path.resolve(path.isAbsolute(resolved) ? resolved : path.join(path.dirname(root), resolved));
 }
 

package/src/cursor-delete-path.ts

@@ -0,0 +1,10 @@
+import * as fs from "node:fs/promises";
+import path from "node:path";
+
+export async function assertDeleteInsideWorkspace(cwd: string, filePath: string): Promise<void> {
+	const root = await fs.realpath(cwd);
+	const target = await fs.realpath(filePath);
+	if (target !== root && !target.startsWith(`${root}${path.sep}`)) {
+		throw new Error(`Delete escapes the workspace: ${filePath}`);
+	}
+}

package/src/cursor-mcp-name.ts

@@ -0,0 +1,15 @@
+/**
+ * Tools Cursor already runs on a dedicated exec channel.
+ * Keep this aligned with CURSOR_NATIVE_TOOL_NAMES in packages/ai/src/providers/cursor.ts.
+ */
+const CURSOR_DEDICATED_CHANNEL_TOOLS = new Set(["bash", "read", "write", "delete", "ls", "grep", "lsp", "todo_write"]);
+
+/**
+ * Name to dispatch from a Cursor MCP call.
+ * Dedicated-channel tools are refused here. Advertised session tools such as eval stay allowed.
+ */
+export function cursorMcpDispatchName(call: { toolName?: string; name?: string }): string | null {
+	const toolName = call.toolName || call.name || "";
+	if (toolName.length === 0 || CURSOR_DEDICATED_CHANNEL_TOOLS.has(toolName)) return null;
+	return toolName;
+}

package/src/cursor.ts

@@ -23,6 +23,8 @@ import {
 	piTimeout,
 } from "@gajae-code/ai/providers/cursor/exec-modern";
 import { sanitizeText } from "@gajae-code/utils";
+import { assertDeleteInsideWorkspace } from "./cursor-delete-path";
+import { cursorMcpDispatchName } from "./cursor-mcp-name";
 import { resolveToCwd } from "./tools/path-utils";
 
 /**
@@ -184,6 +186,7 @@ async function executeDelete(
 			throw new Error(`Path is not a file: ${pathArg}`);
 		}
 
+		await assertDeleteInsideWorkspace(options.cwd, absolutePath);
 		fs.rmSync(absolutePath);
 
 		const sizeText = fileStat.size ? ` (${fileStat.size} bytes)` : "";
@@ -646,11 +649,19 @@ export class CursorExecHandlers implements ICursorExecHandlers {
 
 	async mcp(call: CursorMcpCall, signal?: AbortSignal, markNonAbortable?: () => void) {
 		const options = this.#optionsForCall();
-		const toolName = call.toolName || call.name;
+		const requestedName = call.toolName || call.name || "";
+		const toolName = cursorMcpDispatchName(call);
 		const toolCallId = decodeToolCallId(call.toolCallId);
+		const availableTools = Array.from(options.tools.keys()).filter(
+			name => cursorMcpDispatchName({ toolName: name }) !== null,
+		);
+		if (!toolName) {
+			const message = formatMcpToolErrorMessage(requestedName, availableTools);
+			const result = buildToolErrorResult(message);
+			return createToolResultMessage(toolCallId, requestedName || "mcp", result, true);
+		}
 		const tool = options.tools.get(toolName);
 		if (!tool) {
-			const availableTools = Array.from(options.tools.keys()).filter(name => name.startsWith("mcp__"));
 			const message = formatMcpToolErrorMessage(toolName, availableTools);
 			const result = buildToolErrorResult(message);
 			return createToolResultMessage(toolCallId, toolName, result, true);

package/src/customization/inventory.ts

@@ -35,6 +35,8 @@ export interface LoadCustomizationInventoryOptions {
 	home?: string;
 	/** Skill management policy snapshot (trust, include/ignore, disabledExtensions). */
 	policy?: SkillManagementPolicy;
+	/** User-owned permission to follow external user skill symlinks. */
+	allowExternalUserSkillSymlinks?: boolean;
 	/** Disabled extension ids (`skill:<name>` / `mcp:<name>`) from settings. */
 	disabledExtensions?: string[];
 }
@@ -94,6 +96,7 @@ async function loadSkillRows(options: LoadCustomizationInventoryOptions, _warnin
 		cwd: options.cwd,
 		home: options.home,
 		policy: options.policy,
+		allowExternalUserSkillSymlinks: options.allowExternalUserSkillSymlinks,
 	});
 	const managedPaths = new Set<string>();
 	for (const record of records) {

package/src/debug/report-bundle-parent.ts

@@ -0,0 +1,22 @@
+/** True when a session header names this parent file or its basename. */
+export function sessionBelongsToParent(headerLine: string, parentBasename: string): boolean {
+	let parentSession: unknown;
+	try {
+		parentSession = (JSON.parse(headerLine) as { parentSession?: unknown }).parentSession;
+	} catch {
+		return false;
+	}
+	if (typeof parentSession !== "string" || parentSession.length === 0) return false;
+	const normalized = parentSession.replaceAll("\\", "/");
+	const base =
+		normalized
+			.split("/")
+			.pop()
+			?.replace(/\.jsonl$/, "") ?? "";
+	return (
+		normalized === parentBasename ||
+		base === parentBasename ||
+		normalized.endsWith(`/${parentBasename}`) ||
+		normalized.endsWith(`/${parentBasename}.jsonl`)
+	);
+}

package/src/debug/report-bundle.ts

@@ -17,6 +17,7 @@ import {
 	resolveEquivalentPath,
 } from "@gajae-code/utils";
 import type { CpuProfile, HeapSnapshot } from "./profiler";
+import { sessionBelongsToParent } from "./report-bundle-parent";
 import { collectSystemInfo, sanitizeEnv } from "./system-info";
 
 /** Maximum number of log lines to load into memory at once. */
@@ -283,6 +284,8 @@ async function addSubagentSessions(
 			const archivePath = `subagents/${filename}`;
 			try {
 				const content = await Bun.file(filePath).text();
+				const headerLine = content.split("\n", 1)[0] ?? "";
+				if (!sessionBelongsToParent(headerLine, parentBasename)) continue;
 				data[archivePath] = content;
 				files.push(archivePath);
 

package/src/debug/system-info.ts

@@ -99,7 +99,19 @@ export function formatSystemInfo(info: SystemInfo): string {
 
 /** Sanitize environment variables by redacting sensitive values */
 export function sanitizeEnv(env: Record<string, string | undefined>): Record<string, string> {
-	const SENSITIVE_PATTERNS = [/key/i, /secret/i, /token/i, /pass/i, /auth/i, /credential/i, /api/i, /private/i];
+	const SENSITIVE_PATTERNS = [
+		/key/i,
+		/secret/i,
+		/token/i,
+		/pass/i,
+		/auth/i,
+		/credential/i,
+		/api/i,
+		/private/i,
+		/cookie/i,
+		/dsn/i,
+		/url$/i,
+	];
 
 	const result: Record<string, string> = {};
 	for (const [k, v] of Object.entries(env)) {